← Back to search

@modelcontextprotocol/conformance

modelcontextprotocol Scanned 29d ago

A framework for testing MCP (Model Context Protocol) client and server implementations against the specification.

npm ↗
D
55 / 100

Versions

0.2.0-alpha.10latest
Jul 27, 2026
0.2.0-alpha.9
Jul 1, 2026
0.2.0-alpha.8
Jun 30, 2026
0.2.0-alpha.7
Jun 25, 2026
0.2.0-alpha.6
Jun 24, 2026
+ show 20 moreshow less
0.2.0-alpha.5
Jun 23, 2026
0.2.0-alpha.4
Jun 16, 2026
0.2.0-alpha.3
Jun 12, 2026
0.2.0-alpha.2
Jun 3, 2026
0.2.0-alpha.1
May 26, 2026
0.2.0-alpha.0
May 22, 2026
0.1.16
Mar 30, 2026
0.1.15
Feb 20, 2026
0.1.14
Feb 13, 2026
0.1.13
Feb 5, 2026
0.1.12
Jan 30, 2026
0.1.12-alpha.0
Jan 28, 2026
0.1.11
Jan 23, 2026
0.1.10
Jan 20, 2026
0.1.9
Jan 6, 2026
0.1.8
Dec 15, 2025
0.1.7
Nov 20, 2025
0.1.6
Nov 19, 2025
0.1.5
Nov 11, 2025
0.1.0
Nov 11, 2025
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 16

test_image_content
annotations: none low

Tests image content response

test_audio_content
annotations: none low

Tests audio content response

test_embedded_resource
annotations: none low

Tests embedded resource content response

test_multiple_content_types
annotations: none low

Tests response with multiple content types (text, image, resource)

test_tool_with_logging
annotations: none low

Tests tool that emits log messages during execution

test_tool_with_progress
annotations: none low

Tests tool that reports progress notifications

test_error_handling
annotations: none low

Tests error response handling

test_reconnection
annotations: none low

Tests SSE stream disconnection and client reconnection (SEP-1699). Server will close the stream mid-call and send the result after client reconnects.

test_sampling
annotations: none low

Tests server-initiated sampling (LLM completion request)

prompt string
test_elicitation
annotations: none low

Tests server-initiated elicitation (user input request)

message string
test_elicitation_sep1034_defaults
annotations: none low

Tests elicitation with default values per SEP-1034

test_elicitation_sep1330_enums
annotations: none low

Tests elicitation with enum schema improvements per SEP-1330

json_schema_2020_12_tool
annotations: none low

Tool with JSON Schema 2020-12 features for conformance testing (SEP-1613)

city string name string street string
test_simple_text
annotations: none low

Tests simple text content response

stateless-dispatch
annotations: none low

echo
annotations: none low

Echo the input back

Permissions 3

network medium
Server uses network capabilities via: fetch(), http
shell high
Server uses shell capabilities via: child_process, execSync(), spawn()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 79

low
Tool 'test_image_content' has no annotations annotation_checker · 100%
low
Tool 'test_audio_content' has no annotations annotation_checker · 100%
low
Tool 'test_embedded_resource' has no annotations annotation_checker · 100%
low
Tool 'test_multiple_content_types' has no annotations annotation_checker · 100%
low
Tool 'test_tool_with_logging' has no annotations annotation_checker · 100%
low
Tool 'test_tool_with_progress' has no annotations annotation_checker · 100%
low
Tool 'test_error_handling' has no annotations annotation_checker · 100%
low
Tool 'test_reconnection' has no annotations annotation_checker · 100%
low
Tool 'test_sampling' has no annotations annotation_checker · 100%
low
Tool 'test_elicitation' has no annotations annotation_checker · 100%
low
Tool 'test_elicitation_sep1034_defaults' has no annotations annotation_checker · 100%
low
Tool 'test_elicitation_sep1330_enums' has no annotations annotation_checker · 100%
low
Tool 'json_schema_2020_12_tool' has no annotations annotation_checker · 100%
low
Tool 'test_simple_text' has no annotations annotation_checker · 100%
low
Tool 'stateless-dispatch' has no annotations annotation_checker · 100%
low
Tool 'echo' has no annotations annotation_checker · 100%
high
Hardcoded OAuth client ID in modelcontextprotocol-conformance-7169291/src/scenarios/client/auth/enterprise-managed-authorization.ts auth_checker · 85%
high
Hardcoded OAuth client secret in modelcontextprotocol-conformance-7169291/src/scenarios/client/auth/enterprise-managed-authorization.ts auth_checker · 95%
high
Hardcoded OAuth client ID in modelcontextprotocol-conformance-7169291/src/scenarios/client/auth/authorization-server-migration.ts auth_checker · 85%
high
Hardcoded OAuth client secret in modelcontextprotocol-conformance-7169291/src/scenarios/client/auth/authorization-server-migration.ts auth_checker · 95%
high
Hardcoded OAuth client ID in modelcontextprotocol-conformance-7169291/src/scenarios/client/auth/pre-registration.ts auth_checker · 85%
high
Hardcoded OAuth client secret in modelcontextprotocol-conformance-7169291/src/scenarios/client/auth/pre-registration.ts auth_checker · 95%
high
Hardcoded OAuth client ID in modelcontextprotocol-conformance-7169291/src/scenarios/client/auth/client-credentials.ts auth_checker · 85%
high
Hardcoded OAuth client secret in modelcontextprotocol-conformance-7169291/src/scenarios/client/auth/client-credentials.ts auth_checker · 95%
high
Hardcoded OAuth client secret in modelcontextprotocol-conformance-7169291/src/scenarios/client/auth/issuer-parameter.ts auth_checker · 95%
high
Hardcoded OAuth client ID in modelcontextprotocol-conformance-7169291/src/scenarios/client/auth/wif-jwt-bearer.ts auth_checker · 85%
high
Hardcoded OAuth client secret in modelcontextprotocol-conformance-7169291/src/scenarios/client/auth/march-spec-backcompat.ts auth_checker · 95%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Vulnerable dependency: undici@7.25.0 (GHSA-35p6-xmwp-9g52) dependency_analyzer · 95%
medium
Vulnerable dependency: undici@7.25.0 (GHSA-4cwx-7wf7-3272) dependency_analyzer · 95%
medium
Vulnerable dependency: undici@7.25.0 (GHSA-8xcm-r25x-g524) dependency_analyzer · 95%
medium
Vulnerable dependency: undici@7.25.0 (GHSA-g8m3-5g58-fq7m) dependency_analyzer · 95%
medium
Vulnerable dependency: undici@7.25.0 (GHSA-hm92-r4w5-c3mj) dependency_analyzer · 95%
medium
Vulnerable dependency: undici@7.25.0 (GHSA-jr45-8vmc-qm54) dependency_analyzer · 95%
medium
Vulnerable dependency: undici@7.25.0 (GHSA-m8rv-5g2x-5cg5) dependency_analyzer · 95%
medium
Vulnerable dependency: undici@7.25.0 (GHSA-p88m-4jfj-68fv) dependency_analyzer · 95%
medium
Vulnerable dependency: undici@7.25.0 (GHSA-pr7r-676h-xcf6) dependency_analyzer · 95%
medium
Vulnerable dependency: undici@7.25.0 (GHSA-v3r7-h72x-cjcm) dependency_analyzer · 95%
medium
Vulnerable dependency: undici@7.25.0 (GHSA-vmh5-mc38-953g) dependency_analyzer · 95%
medium
Vulnerable dependency: undici@7.25.0 (GHSA-vxpw-j846-p89q) dependency_analyzer · 95%
medium
Vulnerable dependency: yaml@2.8.2 (GHSA-48c2-rrv3-qjmp) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@4.1.5 (GHSA-82fw-gwwq-j7x9) dependency_analyzer · 95%
medium
Buffer.from base64 in modelcontextprotocol-conformance-7169291/src/scenarios/client/http-custom-headers.ts:87 entropy_analyzer · 75%
medium
Buffer.from base64 in modelcontextprotocol-conformance-7169291/src/scenarios/client/http-custom-headers.ts:130 entropy_analyzer · 75%
medium
Buffer.from base64 in modelcontextprotocol-conformance-7169291/src/scenarios/client/auth/enterprise-managed-authorization.ts:340 entropy_analyzer · 75%
medium
Buffer.from base64 in modelcontextprotocol-conformance-7169291/src/scenarios/client/auth/authorization-server-migration.ts:195 entropy_analyzer · 75%
medium
Buffer.from base64 in modelcontextprotocol-conformance-7169291/src/scenarios/client/auth/pre-registration.ts:64 entropy_analyzer · 75%
medium
Buffer.from base64 in modelcontextprotocol-conformance-7169291/src/scenarios/client/auth/token-endpoint-auth.ts:32 entropy_analyzer · 75%
medium
Buffer.from base64 in modelcontextprotocol-conformance-7169291/src/scenarios/client/auth/client-credentials.ts:318 entropy_analyzer · 75%
info
package.json metadata manifest_parser · 100%
info
Tool: test_image_content manifest_parser · 85%
info
Tool: test_audio_content manifest_parser · 85%
info
Tool: test_embedded_resource manifest_parser · 85%
info
Tool: test_multiple_content_types manifest_parser · 85%
info
Tool: test_tool_with_logging manifest_parser · 85%
info
Tool: test_tool_with_progress manifest_parser · 85%
info
Tool: test_error_handling manifest_parser · 85%
info
Tool: test_reconnection manifest_parser · 85%
info
Tool: test_sampling manifest_parser · 85%
info
Tool: test_elicitation manifest_parser · 85%
info
Tool: test_elicitation_sep1034_defaults manifest_parser · 85%
info
Tool: test_elicitation_sep1330_enums manifest_parser · 85%
info
Tool: json_schema_2020_12_tool manifest_parser · 85%
info
Tool: test_simple_text manifest_parser · 70%
info
Tool: stateless-dispatch manifest_parser · 75%
info
Tool: echo manifest_parser · 85%
info
Transport: streamable-http manifest_parser · 80%
info
Required env vars (5) manifest_parser · 80%
medium
Hardcoded OAuth client ID in modelcontextprotocol-conformance-7169291/src/scenarios/client/auth/enterprise-managed-authorization.ts oauth_scope_analyzer · 80%
medium
Hardcoded OAuth client ID in modelcontextprotocol-conformance-7169291/src/scenarios/client/auth/authorization-server-migration.ts oauth_scope_analyzer · 80%
medium
Hardcoded OAuth client ID in modelcontextprotocol-conformance-7169291/src/scenarios/client/auth/pre-registration.ts oauth_scope_analyzer · 80%
medium
Hardcoded OAuth client ID in modelcontextprotocol-conformance-7169291/src/scenarios/client/auth/client-credentials.ts oauth_scope_analyzer · 80%
medium
Hardcoded OAuth client ID in modelcontextprotocol-conformance-7169291/src/scenarios/client/auth/wif-jwt-bearer.ts oauth_scope_analyzer · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 80%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 372 components sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%